You expect a wrong character to be obvious
WeTheNorth addresses
hn2paw7zadwkcra3qzv5e4q547i7e5lvxm62cfxqftuqdu7moiu2ceyd.onionhn2paw7zfvndw3dovycegeqmvvnf4pl67b3g2p7pohjlzavloosh73id.onionhn2paw7zrgujyhnt6mgxlt2q6uhgbke4itpqitxhyfbumq3wtnckbuyd.onionPrinted as supplied, in no order. Nothing here is checked or timed, so an address that opens is not proof of anything. more about the set
If the address were altered I would spot it. I know what it looks like.
You know what the first six characters look like. The middle forty are random base32 that your eye reads as texture, and a substitution there survives any amount of staring.
The gap: recognition and verification feel identical and are not.
What you are actually reading
A v3 address is 56 characters of base32 followed by .onion. It encodes a public key, a checksum and a version byte. It was designed to be verified by software. Readability by humans was never a goal and was in fact traded away for the extra length that made the old 16 character format obsolete.
Your eye handles this the way it handles any long random string. It grabs the start, grabs the end, and turns everything between into a shape. This is not carelessness. It is how reading works, and it is why nobody can proofread their own phone number backwards. The three addresses on this site share their first seven characters, which makes the effect stronger, not weaker.
How the attack uses that
An attacker who wants a convincing address does not need a full match. Vanity generation lets them brute force a chosen prefix. A few characters is trivial, more is slower, and past a certain length it stops being worth it. So the economics push them toward matching the part you check and leaving the part you do not.
The result is an address that agrees with your memory exactly where your memory is sharp and diverges exactly where it is vague. Then it gets published on a page that looks like every other page listing a we the north darknet market address, and the substitution never gets seen because seeing it was never possible at a glance.
What to do instead of looking
- Copy, never retype. The copy button on the addresses page exists for this and nothing else. Typing by hand introduces the exact class of error you cannot proofread.
- If you must compare, compare in blocks. Take characters 20 to 30 out of the middle rather than reading left to right. The middle is where a substitution lives.
- Compare against something you stored yourself, not against the page in front of you. Two copies of the same wrong address agree perfectly.
- Watch the clipboard on the way in. Paste into the address bar and glance at the end of the string before pressing enter.
The check that actually settles it
Everything above reduces risk without removing it. The only method that ends the question is a signed statement, because a signature covers every character at once and does not care whether your eye can tell base32 apart. It is slower to set up and it is the only thing in this whole section that is not a heuristic.
People skip it because it feels like paperwork for a problem they believe they can solve by being careful. Being careful is the thing that does not work here. That argument gets its own entry in PGP is optional paperwork.
Questions people send about this
Do the real addresses really start the same?
The three on this board share an opening run of characters. That similarity is a feature of how the set was generated and it is also what makes eyeballing them unreliable.
Is checking the last few characters enough?
It is better than nothing and still weak. An attacker can target either end. Only a signature covers the whole string.